fix(auth): authenticate generateIdToken requests with base credentials

[toga4]

When the Application Default Credentials are an external_account or impersonated_service_account configuration, idtoken.NewCredentials sends the generateIdToken request without an Authorization header and the IAM Credentials API rejects it with 401 CREDENTIALS_MISSING.

credsFromDefault always passed a default unauthenticated client to impersonate.IDTokenOptions, and impersonate.NewIDTokenCredentials builds an authenticated client from the provided credentials only when the client is nil.
As a result, the non-impersonated base credentials introduced in #14474 never authenticated the generateIdToken request.

This change passes the user-provided client through as-is, so that impersonate.NewIDTokenCredentials builds a client authenticated with the base credentials when no client is provided.
The added regression test replaces http.DefaultTransport to route all requests to a local test server and asserts that the generateIdToken request carries an Authorization header derived from the base credentials.

Fixes #19939

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request ensures that when a client is not provided, the ID token credentials are built using a client authenticated with the base credentials, resolving an issue with unauthenticated default clients. It also introduces a regression test for this scenario. The review feedback recommends updating the test's custom dialer to use DialContext instead of net.Dial to ensure context cancellation is respected and prevent potential test hangs.